CVE-2008-4636

2008-11-2700:30:00

CWE-78

mitre

web.nvd.nist.gov

cve-2008-4636

yast2-backup

suse linux

novell linux

privilege escalation

shell metacharacters

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

AI Score

6.2

Confidence

Low

EPSS

Percentile

9.8%

JSON

yast2-backup 2.14.2 through 2.16.6 on SUSE Linux and Novell Linux allows local users to gain privileges via shell metacharacters in filenames used by the backup process.

Affected configurations

Nvd

Node

novelllinux_desktopMatch9

novellopen_enterprise_serverMatch-

opensuseopensuseMatch10.2

opensuseopensuseMatch10.3

opensuseopensuseMatch11.0

suselinux_enterprise_serverMatch8

suselinux_enterprise_serverMatch9

susesuse_linux_enterprise_desktopMatch10sp1

susesuse_linux_enterprise_desktopMatch10sp2

susesuse_linux_enterprise_serverMatch10sp1

susesuse_linux_enterprise_serverMatch10sp2

AND

suseyast2-backupRange2.14.2–2.16.6

VendorProductVersionCPE
novelllinux_desktop9cpe:2.3:o:novell:linux_desktop:9:*:*:*:*:*:*:*
novellopen_enterprise_server-cpe:2.3:o:novell:open_enterprise_server:-:*:*:*:*:*:*:*
opensuseopensuse10.2cpe:2.3:o:opensuse:opensuse:10.2:*:*:*:*:*:*:*
opensuseopensuse10.3cpe:2.3:o:opensuse:opensuse:10.3:*:*:*:*:*:*:*
opensuseopensuse11.0cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*
suselinux_enterprise_server8cpe:2.3:o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*
suselinux_enterprise_server9cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*
susesuse_linux_enterprise_desktop10cpe:2.3:o:suse:suse_linux_enterprise_desktop:10:sp1:*:*:*:*:*:*
susesuse_linux_enterprise_desktop10cpe:2.3:o:suse:suse_linux_enterprise_desktop:10:sp2:*:*:*:*:*:*
susesuse_linux_enterprise_server10cpe:2.3:o:suse:suse_linux_enterprise_server:10:sp1:*:*:*:*:*:*

Vendor	Product	Version	CPE
novell	linux_desktop	9	cpe:2.3:o:novell:linux_desktop:9:::::::*
novell	open_enterprise_server	-	cpe:2.3:o:novell:open_enterprise_server:-:::::::*
opensuse	opensuse	10.2	cpe:2.3:o:opensuse:opensuse:10.2:::::::*
opensuse	opensuse	10.3	cpe:2.3:o:opensuse:opensuse:10.3:::::::*
opensuse	opensuse	11.0	cpe:2.3:o:opensuse:opensuse:11.0:::::::*
suse	linux_enterprise_server	8	cpe:2.3:o:suse:linux_enterprise_server:8:::::::*
suse	linux_enterprise_server	9	cpe:2.3:o:suse:linux_enterprise_server:9:::::::*
suse	suse_linux_enterprise_desktop	10	cpe:2.3:o:suse:suse_linux_enterprise_desktop:10:sp1::::::
suse	suse_linux_enterprise_desktop	10	cpe:2.3:o:suse:suse_linux_enterprise_desktop:10:sp2::::::
suse	suse_linux_enterprise_server	10	cpe:2.3:o:suse:suse_linux_enterprise_server:10:sp1::::::